Trojan.Siggen31.36999

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\Software\Classes\GoogleDesktop.search\shell\open\command] '' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe" /search "%1"'
[HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = '%ProgramFiles%\Google\GOOGLE~1\GO36F4~1.DLL'
[HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
[HKLM\Software\Classes\GoogleGadget\shell\open\command] '' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe" /display /load "%1"'
[HKLM\Software\Classes\GoogleGadgetContainer\shell\open\command] '' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe" /display /load "%1"'
[HKLM\Software\Classes\GoogleGadgetManifest\shell\open\command] '' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe" /display /load "%1"'

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\GoogleDesktopManager-051210-111108] 'ImagePath' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe"'

Создает следующие сервисы

'tunnel' system32\DRIVERS\tunnel.sys
'GoogleDesktopManager-051210-111108' %ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe

Вредоносные функции

Внедряет код в

следующие системные процессы:

%WINDIR%\explorer.exe

Устанавливает процедуры перехвата сообщений

о нажатии клавиш клавиатуры:

Библиотека-обработчик для всех процессов: %ProgramFiles(x86)%\Google\Google Desktop Search\GoogleServices.DLL

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\googled@7.exe
%WINDIR%\googled.exe
%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktopresources_en.dll
%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktopcommon.dll
%TEMP%\config.txt
%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktopsetuphelper.exe
%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googleservices.dll
%ALLUSERSPROFILE%\51m5t\3eb93@7\b
%ALLUSERSPROFILE%\51m5t\3eb93@7\px.txt
%ALLUSERSPROFILE%\51m5t\3eb93@7\qqsetupex.exe
%ALLUSERSPROFILE%\51m5t\3eb93@7\v
%ProgramFiles(x86)%\google\google desktop search\favicon.ico
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopresources_en.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktop.exe
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopie.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopapi2.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopoffice.dll
%ProgramFiles(x86)%\google\google desktop search\_new_gzlib.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopcommon.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozilla.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozillastub.js
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozillastub.xpt
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopdeskbar2.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmail.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktophyper.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopnetwork3.dll
%ProgramFiles(x86)%\google\google desktop search\_new_plugin_common.js
%ProgramFiles(x86)%\google\google desktop search\_new_plugin_common.vbs
%ProgramFiles(x86)%\google\google desktop search\_new_topic_sites.dat
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopssd.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googleuiengine.dll
%ProgramFiles(x86)%\google\google desktop search\_new_analogclock_en.gg_new_
%ProgramFiles(x86)%\google\google desktop search\_new_weather_en.gg_new_
%ProgramFiles(x86)%\google\google desktop search\_new_gpac.xml
%ProgramFiles(x86)%\google\google desktop search\_new_googleservices.dll
%ProgramFiles(x86)%\google\google desktop search\_new_sites.txt
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktop64bit.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktop64bitlaunch.exe
%ProgramFiles(x86)%\google\google desktop search\googledesktopsetup.exe
%ProgramFiles(x86)%\google\google desktop search\aa ### warning - do not
%ProgramFiles(x86)%\google\google desktop search\ab ### move or delete these
%ProgramFiles(x86)%\google\google desktop search\ac ### files - your system
%ProgramFiles(x86)%\google\google desktop search\ad ### may stop working
%ProgramFiles(x86)%\google\google desktop search\ae ###
%ProgramFiles(x86)%\google\google desktop search\af ### to uninstall use
%ProgramFiles(x86)%\google\google desktop search\ag ### add-remove programs
%ProgramFiles(x86)%\google\google desktop search\ah ### in the control panel
%ProgramFiles(x86)%\google\google desktop search\ai ### or run
%ProgramFiles(x86)%\google\google desktop search\aj ###
%ProgramFiles(x86)%\google\google desktop search\ak ### googledesktopsetup.exe -uninstall
%ProgramFiles(x86)%\google\google desktop search\al ###
%ALLUSERSPROFILE%\ccrn.url
%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktop.exe
%ProgramFiles(x86)%\google\google desktop search\googledesktopresources_en.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe
%ProgramFiles(x86)%\google\google desktop search\googledesktopie.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopapi2.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopoffice.dll
%ProgramFiles(x86)%\google\google desktop search\gzlib.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopcommon.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopmozilla.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopdeskbar2.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopmail.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktophyper.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopnetwork3.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopssd.dll
%ProgramFiles(x86)%\google\google desktop search\googleuiengine.dll
%ProgramFiles(x86)%\google\google desktop search\googleservices.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktop64bit.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktop64bitlaunch.exe
%LOCALAPPDATA%\google\custom buttons\googledesktop.xml
%LOCALAPPDATA%\google\google desktop\df0515461116\dbeao
%LOCALAPPDATA%\google\google desktop\df0515461116\dbdao
%LOCALAPPDATA%\google\google desktop\df0515461116\dbu2d.ht1
%LOCALAPPDATA%\google\google desktop\df0515461116\dbc2e.ht1
%LOCALAPPDATA%\google\google desktop\df0515461116\dbvmh.ht1
%LOCALAPPDATA%\google\google desktop\df0515461116\dbvm.cf1
%LOCALAPPDATA%\google\google desktop\df0515461116\dbm
%LOCALAPPDATA%\google\google desktop\df0515461116\fiih.ht1
%LOCALAPPDATA%\google\google desktop\df0515461116\fii.cf1
%LOCALAPPDATA%\google\google desktop\df0515461116\fiid-tmp
%LOCALAPPDATA%\google\google desktop\df0515461116\rpmh.ht1
%LOCALAPPDATA%\google\google desktop\df0515461116\rpm.cf1
%LOCALAPPDATA%\google\google desktop\df0515461116\rpm1mh.ht1
%LOCALAPPDATA%\google\google desktop\df0515461116\rpm1m.cf1
%LOCALAPPDATA%\google\google desktop\df0515461116\hpt2i.ht1
%LOCALAPPDATA%\google\google desktop\df0515461116\hp

Удаляет следующие файлы

%ALLUSERSPROFILE%\ccrn.url
%ALLUSERSPROFILE%\51m5t\3eb93@7\v
%ALLUSERSPROFILE%\51m5t\3eb93@7\b

Перемещает следующие файлы

%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopresources_en.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopresources_en.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktop.exe в %ProgramFiles(x86)%\google\google desktop search\googledesktop.exe
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopie.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopie.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopapi2.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopapi2.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopoffice.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopoffice.dll
%ProgramFiles(x86)%\google\google desktop search\_new_gzlib.dll в %ProgramFiles(x86)%\google\google desktop search\gzlib.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopcommon.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopcommon.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozilla.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopmozilla.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozillastub.js в %ProgramFiles(x86)%\google\google desktop search\googledesktopmozillastub.js
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozillastub.xpt в %ProgramFiles(x86)%\google\google desktop search\googledesktopmozillastub.xpt
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopdeskbar2.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopdeskbar2.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmail.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopmail.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktophyper.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktophyper.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopnetwork3.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopnetwork3.dll
%ProgramFiles(x86)%\google\google desktop search\_new_plugin_common.js в %ProgramFiles(x86)%\google\google desktop search\plugin_common.js
%ProgramFiles(x86)%\google\google desktop search\_new_plugin_common.vbs в %ProgramFiles(x86)%\google\google desktop search\plugin_common.vbs
%ProgramFiles(x86)%\google\google desktop search\_new_topic_sites.dat в %ProgramFiles(x86)%\google\google desktop search\topic_sites.dat
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopssd.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopssd.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googleuiengine.dll в %ProgramFiles(x86)%\google\google desktop search\googleuiengine.dll
%ProgramFiles(x86)%\google\google desktop search\_new_analogclock_en.gg_new_ в %ProgramFiles(x86)%\google\google desktop search\analogclock_en.gg
%ProgramFiles(x86)%\google\google desktop search\_new_weather_en.gg_new_ в %ProgramFiles(x86)%\google\google desktop search\weather_en.gg
%ProgramFiles(x86)%\google\google desktop search\_new_gpac.xml в %ProgramFiles(x86)%\google\google desktop search\gpac.xml
%ProgramFiles(x86)%\google\google desktop search\_new_googleservices.dll в %ProgramFiles(x86)%\google\google desktop search\googleservices.dll
%ProgramFiles(x86)%\google\google desktop search\_new_sites.txt в %ProgramFiles(x86)%\google\google desktop search\sites.txt
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktop64bit.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktop64bit.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktop64bitlaunch.exe в %ProgramFiles(x86)%\google\google desktop search\googledesktop64bitlaunch.exe
%LOCALAPPDATA%\google\google desktop\df0515461116\fiid-tmp в %LOCALAPPDATA%\google\google desktop\df0515461116\fiid

Сетевая активность

Подключается к

'localhost':4664

TCP

Другие

'34.##9.100.209':443

UDP

'localhost':50712
'localhost':64819

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''
ClassName: '_GD_MonMD' WindowName: ''
ClassName: 'Progman' WindowName: ''
ClassName: '_GD_Sidebar' WindowName: ''
ClassName: 'IEFrame' WindowName: ''

Создает и запускает на исполнение

'%WINDIR%\googled.exe'
'%WINDIR%\googled@7.exe'
'%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktopsetuphelper.exe' /mdo
'%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe' /system /regserver /quit
'%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktop.exe' /manager /service /path "%ProgramFiles(x86)%\Google\Google Desktop Search\"
'%ALLUSERSPROFILE%\51m5t\3eb93@7\qqsetupex.exe'
'%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe' /display /regserver /quit
'%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe' /system /gdupdate /quit /system
'%ProgramFiles(x86)%\google\google desktop search\googledesktop64bitlaunch.exe' 00430072006500610074006500500072006F0063006500730073 000004DC 0043003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C0047006F006F0067006C0065005C0047006F006...
'%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe'
'%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe' /display /userreg /quit

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней